Penetration Testing: Re: nessus exceptions

[FocusHacks <focushacks () gmail com>]

Indeed, most pen-testers will disclose what tools they use and the raw
output of these tools if you ask.  Especially if you let them know
before the testing starts, that you'll want this information.

It would be sad if your assessment team is doing little more than
cleaning up and adding documentation to a nessus scan report.  :(

There's several applications out that can try to determine what kind
of server is running on a port.  I like to do wierd things like leave
dummy MySQL servers running on port 80 and see if the assessment team
calls it a WWW server.  However, most people here are correct that
there won't be a good way  to tell on your end if it's an actual
nessus scan.  Aside from just asking them what tools they use, the IDS
log fingerprinting seems like the most efficient solution, albeit
maybe a tedious one.